Threats tagged 'ghsa-rv94-x83p-g9w2'

Omnispace Agora Project versions before 26.10.0 have a SQL identifier injection vulnerability that allows a space administrator to escalate privileges. This occurs during the user import flow when caller-controlled agoraFields[] names are used as unvalidated SQL column identifiers. Exploitation can lead to attackers injecting privileged column names or using backtick-injection to gain general administrator privileges.